Known vulnerabilities in Cisco Secure Firewall Management Center (formerly Firepower Management Center, FMC)
Vendor:
Cisco Systems, Inc
Software CPE:
cpe:2.3:a:cisco_systems:cisco_firepower_management_center:*:*:*:*:*:*:*:*
Website:
https://www.cisco.com
Total vulnerabilities:
148
Public exploits:
3
Known exploited (KEV):
2
Highest CVSSv4 Score:
10
Breakdown by Severity Chart
10.0.1.1-2
7.7.12.1-2
7.6.5.1-2
7.4.7.1-3
7.2.11.1-4
7.0.9.1-3
7.4.7
10.1.0
10.0.1
7.7.12
7.6.5
7.4.6
7.2.11
7.0.9
7.4.5
7.6.4
7.4.4
10.0.0
7.7.11
7.6.3
7.7.10.1
7.6.2.1
7.4.2.4
7.2.10.2
7.0.8.1
7.2.10.1
7.7.10
7.6.2
7.0.8
7.4.2.3
7.6.1
7.7.0
7.4.2.2
7.0.7
7.4.3
7.2.10
7.0.5.1
6.5.0.5
6.5.0.4
6.5.0.3
6.5.0.2
6.5.0.1
6.3.0.5
6.3.0.4
6.3.0.3
6.3.0.1
6.4.0.18
6.2.3.1
6.2.3.10
6.2.3.12
6.2.3.13
6.2.3.14
6.2.3.15
6.2.3.16
6.2.3.17
6.2.3.18
6.2.3.2
6.2.3.4
6.2.3.5
6.2.3.8
6.2.3.9
6.4.0.1
6.4.0.10
6.4.0.12
6.4.0.14
6.4.0.16
6.4.0.2
6.4.0.3
6.4.0.4
6.4.0.5
6.4.0.6
6.4.0.8
6.4.0.9
6.6.0.1
6.6.4
6.6.7.1
6.6.7.2
6.7.0.1
7.2.8
7.2.8.1
7.4.2
7.0.6.3
7.2.9
7.4.2.1
7.6.0
7.0.6.1
7.0.6.2
7.0.0.1
7.0.1.1
7.0.2.1
7.0.3
7.0.4
7.0.5
7.2.5.1
7.2.5.2
7.2.6
7.2.7
7.3.1.1
7.3.1.2
7.4.1
7.4.1.1
7.1.0.3
7.2.0.1
7.2.2
7.2.3
7.2.3.1
7.3.1
7.2.5
7.2.4.1
7.4.0
6.4.0.17
7.0.6
7.2.4
7.1.1
7.1.0.2
7.3.0
7.2.1
6.6.7
7.1.0
7.2.0
7.1
7.1.0.1
7.0.2
6.6.5.2
6.4.0.15
7.0.0
7.0.1
6.6.5.1
6.6.0
6.7.0.3
6.6.5
6.4.0.13
6.7.0.2
6.6.3
6.4.0.11
6.7.0
6.6.1
6.3.0.2
6.5.2.0
6.4.0.7
6.5.0
6.2.2.5
6.2.3.11
6.4.0
6.2.3.7
6.2.3.3
6.2.0.6
6.2.3.6
6.1.0.7
6.3.0
6.2.2.4
6.2.2.3
6.2.0.3
6.2.2.1
6.2.0.5
6.2.0.2
6.2.2.2
6.1.0.6
6.2.0.4
6.2.3
6.1.0.1
6.1.0.5
6.2.2
5.4.1.6
6.0.1.3
6.2.1
6.2.0
6.1.0.2
6.1.0
6.0.1
6.0.0
5.4.1
5.4.0.1
5.3.1.2
5.3.0.3
5.4.0
5.3.1
5.3.0
5.2.0
4.10.3
Vulnerabilities (148)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU140037 - Use of Hard-coded Password CVE-2026-20316 |
CWE-259 | High | 7.0.9.1-3, 7.2.11.1-4, 7.4.7.1-3, 7.6.5.1-2, 7.7.12.1-2, 10.0.1.1-2 | 29.07.2026 |
SB2026072974 |
||
| #VU123654 - Improper Privilege Management CVE-2026-20044 |
CWE-269 | Low | 7.0.9, 7.2.11, 7.4.4, 7.6.4, 7.7.11 | 09.03.2026 |
SB2026030964 |
||
| #VU123617 - Deserialization of Untrusted Data CVE-2026-20131 |
CWE-502 | Critical | 7.0.9, 7.2.11, 7.4.6, 7.6.5, 7.7.12, 10.0.1 | 06.03.2026 |
SB2026030636 |
||
| #VU123552 - Error Handling CVE-2026-20068 |
CWE-388 | Medium | 7.2.11, 7.4.4, 7.6.4, 7.7.11 | 04.03.2026 |
SB2026030501 |
||
| #VU123551 - Error Handling CVE-2026-20067 |
CWE-388 | Medium | 7.0.9, 7.2.11, 7.4.4, 7.6.4, 7.7.11 | 04.03.2026 |
SB2026030501 |
||
| #VU123550 - Improper input validation CVE-2026-20066 |
CWE-20 | Medium | 7.4.4, 7.6.4, 7.7.11 | 04.03.2026 |
SB2026030501 |
||
| #VU123549 - Improper Initialization CVE-2026-20065 |
CWE-665 | Medium | 7.0.9, 7.2.11, 7.4.3, 7.6.1 | 04.03.2026 |
SB2026030502 |
||
| #VU123548 - Improper input validation CVE-2026-20005 |
CWE-20 | Medium | 7.6.4, 7.7.11 | 04.03.2026 |
SB2026030501 |
||
| #VU123531 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2026-20018 |
CWE-22 | Low | 7.0.9, 7.2.11, 7.4.4, 7.6.4, 7.7.11 | 04.03.2026 |
SB2026030444 SB2026030445 |
||
| #VU123530 - Authentication Bypass Using an Alternate Path or Channel CVE-2026-20079 |
CWE-288 | Critical | 7.0.9, 7.2.11, 7.4.4, 7.6.4, 7.7.12 | 04.03.2026 |
SB2026030443 |
||
| #VU117302 - Buffer Access with Incorrect Length Value CVE-2025-20360 |
CWE-805 | Medium | 7.4.3, 7.6.2, 7.7.10 | 15.10.2025 |
SB20251015158 SB20251015159 SB20251015160 and 2 more |
||
| #VU117301 - Buffer Under-read CVE-2025-20359 |
CWE-127 | Medium | 7.4.3, 7.6.2, 7.7.10 | 15.10.2025 |
SB20251015157 SB20251015159 SB20251015160 and 2 more |
||
| #VU114107 - Server-Side Request Forgery (SSRF) CVE-2025-20148 |
CWE-918 | Medium | 7.0.7, 7.0.8, 7.2.10, 7.4.2.2, 7.4.2.3, 7.6.0, 7.6.1, 7.6.2, 7.7.0, 7.7.10 | 15.08.2025 |
SB2025081513 |
||
| #VU114106 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CVE-2025-20220 |
CWE-78 | Low | 7.2.10, 7.4.2.2, 7.4.2.3, 7.6.1, 7.6.2, 7.7.0, 7.7.10 | 15.08.2025 |
SB2025081512 |
||
| #VU114103 - Command injection CVE-2025-20306 |
CWE-77 | Low | 7.0.8, 7.2.10, 7.4.2.3, 7.6.1, 7.6.2, 7.7.10 | 15.08.2025 |
SB2025081515 |
||
| #VU114102 - Missing Authorization CVE-2025-20302 |
CWE-862 | Medium | 7.0.7, 7.0.8, 7.2.10, 7.4.2.2, 7.4.2.3, 7.6.1, 7.6.2, 7.7.0, 7.7.10 | 15.08.2025 |
SB2025081514 |
||
| #VU114100 - Missing Authorization CVE-2025-20301 |
CWE-862 | Medium | 7.0.8, 7.2.10, 7.4.2.2, 7.4.2.3, 7.6.1, 7.6.2, 7.7.0, 7.7.10 | 15.08.2025 |
SB2025081514 |
||
| #VU114092 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CVE-2025-20265 |
CWE-74 | High | 7.0.8, 7.7.10 | 14.08.2025 |
SB2025081493 |
||
| #VU114090 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2025-20235 |
CWE-79 | Low | 7.0.8, 7.2.10, 7.4.2.3, 7.6.1, 7.7.0 | 14.08.2025 |
SB2025081491 |
||
| #VU114089 - Improper Neutralization of Data within XPath Expressions CVE-2025-20218 |
CWE-643 | Low | 7.0.7, 7.2.10, 7.4.2.2, 7.6.0, 7.7.10 | 14.08.2025 |
SB2025081490 |
Showing elements 1 - 20 out of 148